Advantech B+B SmartWorx LR77 v2, Руководство по настройке

Страница: 71 / 135

3. CONFIGURATION
Continued from previous page
Item Description
Encapsulation Mode Specifies the IPsec mode, according to the method of encap-
sulation. You can select the
tunnel mode in which the entire IP
datagram is encapsulated or the
transport
mode in which only IP
header is encapsulated.
NAT traversal Enable/disables NAT address translation on the tunnel. If you
use NAT between the end points of the tunnel, then enable this
parameter.
IKE Mode Specifies the mode for establishing a connection ( main or ag-
gressive ). If you select the aggressive mode, then the router es-
tablishes the IPsec tunnel faster, but the encryption is perma-
nently set to 3DES-MD5.
We recommend that you not use the
aggressive mode due to lower security!
IKE Algorithm Specifies the means by which the router selects the algorithm:
•
auto
– The encryption and hash algorithm are selected au-
tomatically.
•
manual
– The encryption and hash algorithm are defined
by the user.
IKE Encryption Encryption algorithm – 3DES, AES128, AES192, AES256.
IKE Hash Hash algorithm – MD5, SHA1, SHA256, SHA384 or SHA512.
IKE DH Group Specifies the Diffie-Hellman groups which determine the strength
of the key used in the key exchange process. Higher group num-
bers are more secure, but require additional time to compute the
key.
ESP Algorithm Specifies the means by which the router selects the algorithm:
•
auto – The encryption and hash algorithm are selected au-
tomatically.
•
manual – The encryption and hash algorithm are defined
by the user.
ESP Encryption Encryption algorithm – DES, 3DES, AES128, AES192, AES256.
ESP Hash Hash algorithm – MD5, SHA1, SHA256, SHA384 or SHA512.
PFS Enables/disables the Perfect Forward Secrecy function. The
function ensures that derived session keys are not compromised
if one of the private keys is compromised in the future.
Continued on next page
64